Slashdot Mirror
Amazon's EC2 Having Problems With Spam and Malware
jamie pointed out a story about the recent problems Amazon's EC2 service has been having with malware and spam. "EC2 space is now actively blocked by Outblaze, and has been listed by Spamhaus in their PBL list [...] However as Seth Breidbart noted in the comments, 'note that Amazon will terminate the instance. That means that the spammer just creates another instance, which gets a new IP address, and continues spamming.' True enough -- as described, instance termination simply isn't good enough."
While I'm against the death penalty, I might be willing to consider it for spammers.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
They have the credit card numbers of these people, no? Add a $1000 (or more) charge to the TOS each time someone gets caught spamming through them. That should make a pretty clear point.
Why aren't Amazon terminating the accounts of offenders, and blacklisting whatever payment method they're using? It's a paid service, it's not like spammers can register for new accounts as much as they like, they're going to run out of credit card numbers (well, assuming their activities aren't more nefarious than mere spam).
It's not in Amazon's interests to have EC2 blacklisted.
Somebody finally solved the ????? = Profit equation. What's everyone getting so worked up about?
Everybody's a libertarian 'till their neighbour's becomes a crack house.
or virtual/private server company? And what would happen to the spammers? Account cancelled, so they'd just find another colo/host, or use one of many stolen credit cards to register another account with same host, under a different name. How is this any different?
body massage!
Spammers with unlimited computing power?? Where do i sign up?
The top hit from Google would have told you. It's Amazon's Elastic Compute Cloud.
I'm afraid taint.org might not be safe for work.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Once they have the name of the instance, they also know who launched it -- after all, they are billing someone.
I like the suggestion to charge a large fee to the credit card they have on file, but what about simply banning the account in question?
Don't thank God, thank a doctor!
No, it's apparently something in the Amazon. I guess Brazilian deforestation is a major contributor to the global increase in salted canned pig meat.
The UK Honeynet Project spotted this a few days earlier :)
http://www.ukhoneynet.org/2008/06/30/it-had-to-happen
Offer a spamfree block of IPs using their persistent IP offering, and let people put in a large deposit when getting an IP there. If they spam, confiscate the deposit. Use the interest on the deposit to offset the cost of triaging abuse complaints.
Although if mail is incidental to your business you can probably just host a relay offsite.
Here is a wild idea... WILD.. Off the hook insanity....
Just block ALL of EC2 from being able to send out anything on port 25 and 587.
Problem solved. Last time I checked EC2 has a lot more interesting uses than running mail server software.
EV certificates cannot sign mail, only server to server communication. E-mail signing certificates cost about $30, and require absolutely no proof of identity, just existence. This is no barrier whatsoever.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
I think all the ideas of placing a deposit or putting an extra charge per message are against the EC2 model. The whole idea is to offer a high capability solution at a low entry price that scales easily.
Spammers and abusers tend to have distinctive patterns and this what Amazon should be paying attention to. Ie. some guy using a US credit card, logging to his instance from eastern Europe and sending a zillion emails messages the second day after sign up should raise some doubts. Manual inspection of suspicious traffic can be very costly but they can easily build a growing list of trusted customers who use the service for legitimate reasons and monitor suspicious traffic from new registrations.
If this would work, it would probably need to be combined with one of the other ideas above -- either requiring additional verification or posting a bond to remove the filters from instances created under a verified/bonded account. Some users will have legitimate reasons to send emails (some a few, some many) but many probably don't.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
Wikipedia says it's the north eastern corner of the city of London, roughly. I don't get the article, either.
Stasis is death. Embrace change.
why not run an inward facing IDS- something like snort. It's easy enough to setup a script that automatically terminates accounts of people sending abuse, and to do it on the first instance of that abuse.
So what you're saying is we basically we had a unique opportunity for a slashdot user to get lucky?
That just establishes spam as $10 CPM ads. That'll clear out the inbox so the more profitable things (including things that can't get ads elsewhere in the USA because they're taboo) will get even more visiblity.
(Damn. I've got modpoints, and professional experience at mailfiltering too - but I'll never find this thread again if pyster replies and I've posted AC... )
Which blacklist, and what reasons did they give for listing you? You want to whine and rant? Fine, that's what Slashdot seems to be made for. But if you want your point to be taken seriously and not modded into oblivion, give us the information that will allow us to make informed assessments of your claims about the lameness of the blacklist - and, possibly, the lameness of the admin of the site that chose to use that particular list too, if things are as you say they are. Some lists are dangerous if used inappropriately for some mail streams, but most of the better-known ones are safe and extremely powerful tools if used responsibly (and that includes having a working postmaster@ address and a willingness to communicate with and work with those who find themselves blocked). Spam is a serious problem, and for many places the best first-level defence against their servers being overwhelmed is judicious use of carefully selected blacklists.
For what it's worth, I find blacklists utterly invaluable. The MX servers under my control consult several for straight-up blocking (with a few local whitelistings where appropriate), and a few more for SpamAssassin scoring purposes. We're blocking about half a million messages per day, and get maybe eight queries per months about "accidentally" blocked mail - almost none of which are directly due to an errant blacklisting these days. Most of what we block is due to straight-up rejection due to inclusion in a blacklist, and the last query we got about that kind of block was due to some site that got itself listed in the CBL - boo-fricken-hoo, they deserved it and once I explained the situation they were thankful that we blocked them using the CBL because they were able to fix the problem before they got a Spamcopping or worse.
I don't know your exact situation. For all I know, you could have a legitimate beef about how some particularly crappy blacklist is created and operated. Conversely, you could just be another whiney person who likes to complain because their personal system with a generic-looking and not-clearly-static PTR got listed somewhere because 80% of the /24 it's in is part of various botnets (and if that's the case, I've got a whole lot of helpful information that would help you improve deliverability here and at many other places, now and forever, without changing providers). There could be a real problem with a particular list, or you could just be tilting at windmills and be much better off addressing the underlying issue that caused the listing and moving on. Tell us what the issue was, let us make up our own minds. Hell, you might even learn a thing or two - as, indeed, might I if there's any merit to your claims.
So long as it's not your stupid bank storing unencrypted info on tapes that went MIA. I guess the few million people that it has happened to this year, alone, would be annoyed, if not stupid.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
Ah, the PBL. That's where your argument falls to pieces.
From http://www.spamhaus.org/pbl/index.lasso :
PBL IP address ranges are added and maintained by each network participating in the PBL project, working in conjunction with the Spamhaus PBL team, to help apply their outbound email policies.
So, your ISP told Spamhaus that mail shouldn't be coming from the range your IP address is in. Not Spamhaus making a trite, petty and vindictive block for the fun of it. Not some blacklist deciding in error to block a whole /24 full of static addresses with REAL rDNS records for most of it because they found a couple of zombied machines with vaguely generic-looking PTRs in it. This is a case of the people you pay for connectivity telling Spamhaus that the rest of the world should not accept mail from your IP address or others near it until further notice - they're being good neighbours, and are to be applauded.
If you have a static address you can poke a hole in the PBL for it pretty easily - *you* can provide that further notice:
A feature of the PBL is the elimination of 'false positives' with a server-identifying and automatic removal mechanism for single IP addresses. This allows end users with static IP addresses within a larger dynamic pool, and legitimate mail server operators, to assert that in their opinion their IP addresses are a trustworthy source of email and to automatically remove (suppress) their IP addresses from the PBL database. Safeguards are built in to prevent abuse of this facility by spammers (and particularly by automated bots).
Do your research. The PBL is pretty damn useful, and you probably qualify for free use. If you have an unfiltered postmaster address on your domain (you do, don't you?) the smart thing would be to start blocking with it but make sure the rejection contains something like "Rejected: $IP_ADDRESS listed in Spamhaus PBL ( http://lookup-urlip_address/ ) - please contact postmaster@whineyblacklisthater.org for assistance if required" - you'll find that the "false-positives" for it are almost invariably from people who don't know what the PBL is and want to do their own thing, regardless of the practicalities the rest of the world has to face. Why should I or anyone else accept mail from somewhere your own ISP or their upstream provider has said I shouldn't?
Why do all the antispam nazi's solutions ignore the collateral damage to innocent by standers? "They should educate themselves" "they should switch providers" they scream. Black lists do nothing but break the system. I'd rather get all the spam than have important mail bounce. Just last week I had a mission critical email bounce because of some lame blacklist. This email not getting to its recipient would have basically ruined my life. Its a good thing I have the ability to send mail from more than once source.
If you formulate your mails the same way you usually formulate your posts on Slashdot , I'm really not surprised, Mr. Fr0sti P1ss GNNA.
All those moments will be lost in time, like tears in rain. Time to die.
You do realise the PBL is used by your ISP to tell Spamhaus that email should not originate from certain IP ranges - it appears you or the sender are sending out email from an IP range THAT IS NOT SUPPOSED TO DIRECTLY SEND. The fault is not with Spamhaus. You really do need to educate yourself about email.
2 miles East of the Centre.
"There is nothing nice about Steve Jobs and nothing evil about Bill Gates." - Chuck Peddle
Reduce, reuse, cycle
Yeah but high school physics would have told me MC4.
~~~
Write in Cowboy Neal for President and Alex Birch for Vice-President.
Seriously, an email not being delivered would have ruined your life? Who's smoking crack?